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IN THE CLAIMS 

Please amend claims 1, 14, 27, 29, and 30 as set forth below. All pending claims 
and their present status are produced below. 

1 . (Currently Amended) A method for calculating application verb response times, 
comprising: 
receiving packet data; 
aggregating the packet data into flows; 

identifying application verbs and information relating to them associated with the 
flows; 

determining whether the application verbs are vali d, the application verbs being valid 
if predetermined criteria indicate that response times of the application verbs 
should be measured: 

responsive to determining that the application verbs are valid, updating a state 
machine; 

determining whether the state machine is in a valid state; and 

responsive to determining that the state machine is in a valid state, storing the 

information relating to the application verbs, wherein the information relating 
to the application verbs is capable of being used to calculate response times 
associated therewith. 



2. (Original) The method as recited in claim I, and further comprising determining 
whether the packet data is associated with a new flow. 
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3. (Original) The method as recited in claim 2, wherein if the packet data is determined 
to be associated with a new flow, further comprising creating a flow, creating a data 
structure, and inserting the data structure into the flow. 

4. (Original) The method as recited in claim 3, wherein the creation of the data structure 
includes identifying a protocol identifier associated with the flow, and determining a 
number of known application verbs associated with the protocol identifier. 

5. (Original) The method as recited in claim 4, wherein the creation of the data structure 
further includes allocating memory for the data structure based on the number of 
known application verbs associated with the protocol identifier. 

6. (Original) The method as recited in claim 4, wherein the number of application verbs 
associated with the protocol identifier is determined utilizing a map. 

7. (Original) The method as recited in claim 6, wherein the map maps to a RMON tree. 

8. (Original) The method as recited in claim 1 , and further comprising inserting a data 
structure into the flows. 

9. (Original) The method as recited in claim 8, wherein the aggregation includes 
populating and updating the data structure with the information. 

10. (Canceled) 
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1 1 . (Original) The method as recited in claim 9, wherein the aggregation further includes 
determining whether a response is complete, and calculating a response time if it is 
determined that the response is complete. 

12. (Canceled) 

13. (Original) The method as recited in claim 1 , wherein the information relating to the 
application verbs is capable of being used to calculate response times associated 
therewith in real-time. 

14. (Currently Amended) A computer-readable medium having a computer program 
product for calculating application verb response times, comprising: 
computer code for receiving packet data; 

computer code for aggregating the packet data into flows; 

computer code for identifying information relating to application verbs associated 

with the flows; 

computer code for determining whether the application verbs are valid^Jhe. 

application verbs being valid if predetermined criteria indicate that response 

times of the application, verbs should be measured : 
computer code for, responsive to determining that the application verbs are valid, 

updating a state machine; 
computer code for determining whether the state machine is in a valid state; and 
computer code for, responsive to detennining that the state machine is in a valid state, 

storing die information relating to the application verbs, wherein the 
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information relating to the application verbs is capable of being used to 
calculate response times associated therewith. 

15. (Previously Presented) The computer-readable medium of claim 14, wherein the 
computer program product further comprises computer code for determining whether 
the packet data is associated with a new flow. 

16. (Previously Presented) The computer-readable medium of claim 15, wherein if the 
packet data is determined to be associated with a new flow, further comprising 
computer code for creating a flow, creating a data structure, and inserting the data 
structure into the flow. 

17. (Previously Presented) The computer-readable medium of claim 1 6, wherein the 
creation of the data structure includes identifying a protocol identifier associated with 
the flow, and determining a number of application verbs associated with the protocol 
identifier. 

18. (Previously Presented) The computer-readable medium of claim 17, wherein the 
creation of the data structure further includes allocating memory for the data structure 
based on the number of known application verbs associated with die protocol identifier. 

19. (Previously Presented) The computer-readable medium of claim 17, wherein the 
number of known application verbs associated with the protocol identifier is 
determined utilizing a map. 
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20. (Previously Presented) The computer-readable medium of claim 19, wherein the map 
maps to a RMON tree. 

21. (Previously Presented) The computer-readable medium of claim 14, wherein the 
computer program product further comprises computer code for inserting a data 
structure into the flows. 

22. (Previously Presented) The computer-readable medium of claim 2 1 , wherein the 
aggregation includes populating and updating the data structure with the information. 

23. (Canceled) 

24. (Previously Presented) The computer-readable medium of claim 22, wherein the 
aggregation further includes determining whether a response is complete, and 
calculating a response time if it is determined that the response is complete. 

25. (Canceled) 

26. (Previously Presented) The computer-readable medium of claim 14, wherein the 
information relating to the application verbs is capable of being used to calculate 
response times associated therewith in real-time, 

27. (Currently Amended) A system for calculating application verb response times, 
comprising: 

means for receiving packet data- 
means for aggregating the packet data into flows; 
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means for identifying information relating to application verbs associated with the 
flows; 

means for determining whether the application verbs are vAlid 1 the application verbs 
being valid if predetermined criteria indica te that response times of the application 
verbs should be measured ; 

means for, responsive to determining that the application verbs are valid, updating a 
state machine; 

means for determining whether the state machine is in a valid state; and 
means for, responsive to determining that the state machine is in a valid state, storing 
the information relating to the application verbs, wherein the information 
relating to the application verbs is capable of being used to calculate response 
times associated therewith. 

28. (Canceled) 

29, (Currently Amended) A method for calculating response times, comprising: 
receiving packet data; 

aggregating the packet data into a flow; 

identifying information relating to application verbs associated with the flow; 
determining whether the application verbs are valid , the application v erbs being valid 

if predetermined criteria indicate that response times of the application verbs 

should be measured ; 
responsive to determining that the application verbs are valid, updating a state 

machine; 
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determining whether the state machine is in a valid state; 

responsive to determining that the state machine is in a valid state, storing the 

information relating to the application verbs in a data structure; 
inserting the data structure in the flow; and 
mapping the data structure to a remote monitoring (RMON) tree. 

30. (Currently Amended) A method for calculating response times, comprising: 

(a) receiving packet data; 

(b) determining whether the packet data is associated with a new flow; 

(c) if the packet data is determined to be associated with a new flow: 

(i) creating a flow, 

(ii) providing a notification of the flow, 

(ffi) creating a data structure in response to the notification, the creation of the data 
structure including: 

1 ) identifying a protocol identifier associated with the flow, 

2) caching the protocol identifier, 

3) determining a number of known application verbs associated with the 
protocol identifier, and 

4) allocating memory for the data structure based on the number of 
known application verbs associated with the protocol identifier, and 

(iv) inserting the data structure into the flow; and 

(d) aggregating the packet data by: 

(v) identifying application verbs in the flow, 

Case 24523-09627 (Amendment O 

U.S. Application No. 10/039,1 1 1 8 

24523/09627/DOCS/l 602984 .4 

PAGE 10122 1 RCVD AT 5/22/2006 2:16:27 PM [Eastern Daylight Time] 1 SVR;USPTO-EFXRF-6139 1 DNIS:2738300 1 C$!D:65093852Q0 * DURATION (mnvss):05-38 



MAY-22-06 11:15AM FROVhFenwick & West Mountain View 



650 938 5200 



T-256 P. 011/022 F-409 



determining whether the application verbs are v*Hd 1 the application verbs being valid, 
if predetermined criteria indicate that response times of the application ve rbs should 
be measured : 

(vi) responsive to determining that the applications verbs are valid, updating a 
state machine, 

(vii) determining whether a response associated with the flow is complete, 

(viii) responsive to determining that the response associated with the flow is 
complete, calculating a response time, 

(ix) determining whether the state machine is in a valid state, and 

(x) responsive to determining that the state machine is in a valid state, storing 
information relating to the application verbs, wherein the information relating to 
the application verbs is capable of being used to calculate the response time. 
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